Binance Hit by $6.3 Billion Hack, FBI Blames North Korea

Binance, the world's largest crypto exchange, suffered one of the biggest attacks in the industry's history on October 29, when roughly $6.3 billion in digital assets was drained from its hot wallets. The FBI said on October 31 that North Korea was behind the theft.

According to Binance's initial review, the breach began with the compromised laptop of a DevOps engineer. Attackers are believed to have used it to reach a service container and make unauthorized withdrawals. The company says it has found no evidence that wallet private keys were leaked, and it plans to publish a detailed technical report once the investigation ends.

Blockchain analytics firm TRM Labs says the attackers moved about $6.36 billion across 10 blockchains in around 20 minutes. The haul included Bitcoin, Ethereum and stablecoins such as USDT and USDC. Binance paused withdrawals and worked with blockchain firms and stablecoin issuers to freeze roughly $3 billion on-chain, including about $1.77 billion in USDT by Tether and $825 million in USDC by Circle.

North Korea and TraderTraitor

The FBI links the attack to North Korean cyber activity it tracks as TraderTraitor, the same cluster it tied to the roughly $1.5 billion Bybit theft in February 2025. The Binance heist is more than four times larger, making it the biggest crypto theft recorded. The bureau says the group is mostly converting the loot into Ethereum and is expected to try to obscure it through DeFi protocols and instant token swap services. It has asked crypto service providers, analytics firms and DeFi platforms to block transactions from linked addresses.

Users to be covered

Binance says the losses will not be passed on to customers. It will cover them with its Secure Asset Fund for Users (SAFU) and corporate resources, initially earmarking about $6.34 billion and buying back affected assets. By October 31 about 90% had been replaced; the November 1 update put that at 95%, with BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances fully covered. The remaining 5% consists of less liquid tokens that take longer to source.

Withdrawals began reopening in stages on November 1, deposits were never affected, and Binance published a new proof-of-reserves snapshot. Markets reacted sharply: Bitcoin fell to a six-week low, Ethereum to a two-month low, and BNB lost more than 8%. The incident renews scrutiny of centralized exchange security, since a single employee's device was enough to put billions at risk.